I was reading the following code (dot1x bridge bypass): https://github.com/mubix/8021xbridge/blob/master/scripts/trans_bridge.prepop

A quick description, we have 2 interfaces, the first is connected to a switch ($SWINT) and the other to our target host. The goal is to interact with the rest of the network, while making it look like the traffic is generated by the target host.

From the referenced code, what I am trying to figure out is why both of the below commands are needed:

# use ebtables to source NAT the $COMPMAC for traffic leaving the device from the bridge mac address
(A)ebtables -t nat -A POSTROUTING -s $SWMAC -o $SWINT -j snat --to-src $COMPMAC
(B)ebtables -t nat -A POSTROUTING -s $SWMAC -o $BRINT -j snat --to-src $COMPMAC

I don't get why it's needed to SNAT the POSTROUTING traffic of $BRINT. Since our goal is to avoid transmitting any frames towards switch side interface with source MAC different than the target host, shouldn't the first ebtables rule be suffice?

Or in other words, isn't $SWINT (switch side interface) the only way any frames are getting to the switch? Based on the diagram below, the rule (B) looks redundant since we only care for frames going towards eth0 (SWINT), and we already apply SNAT to eth0.

Some good resources I found on bridges (but still haven't answered my question) are:

Understanding Linux Network Internals

Anatomy of Linux Bridge

ebtables with Linux Bridge

https://doc.lagout.org/operating%20system%20/linux/Understanding%20Linux%20Network%20Internals.pdf Page:359 https://doc.lagout.org/operating%20system%20/linux/Understanding%20Linux%20Network%20Internals.pdf Page 359

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.